7 ms·
Most people consider the fact that your handset will readily talk to any base station that's on the air to be a feature. Try to imagine how things would work if
by shereadsthenews 8y ago
Most people consider the fact that your handset will readily talk to any base station that's on the air to be a feature. Try to imagine how things would work if you had to authenticate and authorize every station on the network. It's true that anyone who gets on the air and speaks the air protocol can screw with your phone. Those people are also violating multiple laws and regulations in the course of doing so.
- deleted 8y ago[deleted]
- jskaodjnf 8y agoFrom 3G on, every base station is authenticated and virtually all traffic on the air is encrypted. There are issues with stingrays - but these happen due to protocol edge-cases before authentication is established. [Edit: this paper uses side channels to collect information, but that's what a sniffer can do] Every base station is authenticated. In most countries, all connections are encrypted.
- peterwwillis 8y agoSorry, I haven't kept up on my phreaking - is there encryption for 3G which hasn't been broken yet?
- jskaodjnf 8y agoNot sure about 3G algorithms - but that's why 4G moved on to AES. What exactly are you trying to say? Worrying customers can easily enforce 4G. Networks should drop 2G and 3G, but still, things are getting better.
- peterwwillis 8y agoI'm saying it doesn't matter whether everything is authenticated and encrypted, it's all vulnerable. Even if 4G wasn't, you can just downgrade and then crack.
- jskaodjnf 8y agoWhere exactly vulnerable against which type of attacker? In 4G there are location and identity leaks, and denial of service (which is why smartphones and carriers should drop 2G and 3G). Or is this a "technology is all bad" kind of comment?
- Yetanfou 8y agoI consider it more to be a 'why oh why do these protocols continue to be designed and specified in such a way as to be known to be vulnerable to eavesdropping' kind of comment.
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- sp332 8y agoMaybe your phone could trust all base stations operated by AT&T and T-Mobile, instead of manually verifying each one.
- shereadsthenews 8y agoOK but what you are suggesting is a fully authenticated air interface and a massive PKI deployment, which while not impossible for future protocols face obvious hurdles.
- batbomb 8y agoWhat happens when you travel internationally?
- sp332 8y agoJust add another root certificate to your local store, like with a web browser.
- radicaldreamer 8y agoI mean you can do authentication without doing it per base station... the real reason we don’t have anything like this is because it’s a lot of work to make this work well worldwide and because a lot of governments are not interested in making spoofing base stations harder on themselves.
- jskaodjnf 8y agoThere is per-basestation authentication. The basestation receives a key that is derived from your permanent key within your SIM card. Roaming is a bit special, but this still holds. You then trust both operators, not just your home operator.
- pedrocr 8y agoShouldn't we just fix this one layer above? Just like the internet treat the network as hostile and use strong encryption to connect to your network provider. If someone uses a stingray you use their bandwidth but they see nothing because you're running encrypted VoLTE.
- Teever 8y agoIt's astart but from my understanding implementing strong encryption on the layer above does little to mitigate physical location tracking issues that arise from spoofed towers.
- mindslight 8y agoNothing short of removing all devices identifiers (IMSI, IMEI, etc) and using an untraceable payment system for network access (eg blinded tokens) will mitigate the location tracking ability of the carriers. The perfect is the enemy of the good and cops do use stingrays for a reason. But targeted government surveillance is only one privacy threat, and carriers have no compunctions about bulk selling your location to the mass surveillance industry.
- dcow 8y ago
- nabla9 8y agoIt's not that simple. Both 3G and 4G have mutual authentication. You need to trick the handset into downgrading the protocol if you want it to talk to your own fake base station.
- gsich 8y agoJamming should be enough. But depending on the frequencies used, one band might not be enough.
- Pristina 8y agoYeah I'm sure the cops and the lawyers will stop the bad guys using the power of the law.
- e12e 8y agoWhat? I mean your provider ships you a computer that's dedicated to authentication your device on the network (a sim card) - it shouldn't be infeasible to authenticate the nodes when you can bootstrap off an actual trusted device. With roaming, your provider could cross sign other providers - and for long range/international roaming you could maybe allow forwarding of encrypted requests for authentication over an untrusted channel. That would probably be enough for some level of (location) tracking - but there'd be no need to allow any regular traffic over such links. In theory. In practice, that'd probably be too expensive, and you'd get better service and security relying on wlan and something like signal....